{"id":"CVE-2017-8891","details":"Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads.","modified":"2026-07-08T11:36:38.683263Z","published":"2017-05-10T16:29:00.227Z","references":[{"type":"FIX","url":"http://openwall.com/lists/oss-security/2017/05/10/1"},{"type":"FIX","url":"https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346"},{"type":"FIX","url":"https://github.com/dropbox/lepton/issues/87"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dropbox/lepton","events":[{"introduced":"c378cbfa2daaa99e8828be7395013f94cedb1bcc"},{"last_affected":"c378cbfa2daaa99e8828be7395013f94cedb1bcc"},{"fixed":"82167c144a322cc956da45407f6dce8d4303d346"}],"database_specific":{"cpe":"cpe:2.3:a:dropbox:lepton:1.2.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.2.1"},{"last_affected":"1.2.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.2.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8891.json","vanir_signatures_modified":"2026-07-08T11:36:38Z","vanir_signatures":[{"source":"https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346","target":{"file":"src/lepton/vp8_decoder.cc"},"deprecated":false,"digest":{"line_hashes":["159548571258986322238776647046548753064","39350346401471504086858263354224974567","114249630470462365164529340061812825261","224783973320702116608563977717599054096","318142797505572948893440452073795306824","283798816933924975585219583092774611889","314678254315387458533672861798594793647","321698767621727103834527717197129610850","156412432547229152923612288602553601485","161547218510824082888181917335613079937","100572031566266426414518343941402582425","319860669975468017438043927960077700297","149675271633949007479188669480320749883","37376949316336884606350086861662995833","300697915019048962086643010603185693764"],"threshold":0.9},"id":"CVE-2017-8891-1d051b62","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346","target":{"file":"src/lepton/bitops.hh"},"deprecated":false,"digest":{"line_hashes":["314071305879422203352417641333121884808","196255874029856677362052425588051527158","70392186411237790143914193806125212545","193210458976089337072729924769243800356","202664343419612971196904659096093524699","145631498893344382670588488413600828380","207700876068794755845473659853552077646","327937561458595663739959436565596969492","130094591969341488232814562694191730827"],"threshold":0.9},"id":"CVE-2017-8891-5e06033f"},{"deprecated":false,"digest":{"line_hashes":["166710555843909245683899232161603044173","312730344868618540975331084934583245622","265510303578159240517356456581907607285","322787428952934496016279410108127208837"],"threshold":0.9},"id":"CVE-2017-8891-a9ec0620","signature_type":"Line","signature_version":"v1","source":"https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346","target":{"file":"src/lepton/lepton_codec.cc"}},{"deprecated":false,"digest":{"function_hash":"85881905655203848891677532301654687322","length":716},"id":"CVE-2017-8891-b5eae391","signature_type":"Function","signature_version":"v1","source":"https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346","target":{"file":"src/lepton/bitops.cc","function":"bounded_iostream::write_no_buffer"}},{"target":{"file":"src/lepton/bitops.cc"},"deprecated":false,"digest":{"line_hashes":["324364481743382595350208590128175957652","252784573190285570612371181540055979148","278601953651909222513029664346829420933","89162462976366885035506321050712599647","116354405341811769801040351144643992451","262127703418006626026286982289841872693","45579194772576923245059060269568560786","261732935906384895701009244165015140376"],"threshold":0.9},"id":"CVE-2017-8891-e51e0ffa","signature_type":"Line","signature_version":"v1","source":"https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346"},{"target":{"file":"src/vp8/decoder/boolreader.hh"},"deprecated":false,"digest":{"line_hashes":["97298164820651383507473015866570065381","20179038577639057928886573998262249039","144024260365033646800639789168616278288","98780428089348859496415584629336681321"],"threshold":0.9},"id":"CVE-2017-8891-ee2868d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}